MR ROBOT Android banking trojan service targets Indian bank customers with fake bank apps

What happened

CloudSEK published research on October 28, 2026 describing MR ROBOT as a previously unreported Android Malware-as-a-Service operation. It is not a single-actor campaign but a rented crimeware platform: a master operator leases access to affiliates, who use a Telegram bot called “APK Shield” and a web control panel (v7.0) to build personalized banking trojans on demand CloudSEK. Infosecurity Magazine covered the findings on October 29, 2026 Infosecurity Magazine.

How the operation works, per the sources:

• Distribution: fake Play-Store-style pages and messaging-app lures. The kit impersonates banks, utility providers and government services. The storefront offered about 36 lure apps, including public- and private-sector banks, gas, water and electricity billers, telecom recharge, and RTO traffic-fine scams CloudSEK. The case CloudSEK started from was a bank-impersonating APK delivered under an “Aadhaar update” lure.
• Install chain: a lightweight dropper (com.apkshield.installer.*) decrypts an AES-encrypted second stage, which re-signs and installs the actual banking trojan.
• Capabilities: SMS and OTP interception, outbound SMS, and unconditional call forwarding via the carrier code 21<number>#, which reroutes incoming calls, including bank fraud-check callbacks, to a mule number. It also shows HTML phishing overlays that harvest Aadhaar, PAN, card number and CVV, ATM PIN, UPI and net-banking credentials, and it has no launcher icon, so the app disappears after install.
• Exfiltration: a Firebase Realtime Database C2 plus a Telegram channel as a second channel. Stolen data surfaces in the operator panel for real-time fraud.
• Evasion: per-build throwaway signing certificates, emulator checks, a 48-hour or 3-launch dormancy gate, no launcher icon, and a local-VPN black-hole CloudSEK.
• Business model: a tiered sub-admin and affiliate reseller model, with per-affiliate App IDs that carry an expiry, i.e. subscription licensing.

CloudSEK tracked two affiliates. Affiliate A showed about 154 enrolled devices and about 3,270 intercepted messages in its panel. Affiliate B, via an exposed database, showed 153 devices and 5,407 intercepted SMS, with *21# call forwarding active on 58% of victims and OTPs harvested from more than a dozen banks and payments banks CloudSEK. Infosecurity reports that this data was collected between July 16 and 30, 2026, and that around 4,000 of the messages came from bank and telecommunications short codes Infosecurity Magazine.

CloudSEK says MR ROBOT shares tradecraft, notably *21# call forwarding and per-customer builders, with FatBoyPanel and RedWing, operations previously documented by Zimperium. Its kit, panel, storefront and licensing scheme were publicly undocumented.

Researchers found the operator’s own admin console app (a WebView wrapper around the panel) and the panel’s public web assets, which revealed the backend design. Lures for two different banks embedded a byte-identical Firebase configuration, so one affiliate’s whole catalog drains into a single Firebase project CloudSEK.

Am I affected?

You are at risk if:

• You are an Android user who banks in India and may receive APK links by SMS, WhatsApp or Telegram, especially “Aadhaar update”, KYC, utility bill, telecom recharge or traffic-fine themes. The malware needs sideloading, so the main exposure is installing an app outside a trusted store.
• You run fraud, mobile security or threat intelligence for an Indian bank, biller or telecom. Your customers’ SMS OTPs and phone-based verification callbacks are the targets.
• Your fraud checks rely on SMS OTP or on calling the customer back. Call forwarding defeats the callback step.

Signs on a device or in a hunt, based on the sources:

• An installed app with no launcher icon, or a package under com.apkshield.installer.*.
• Unexpected unconditional call forwarding on the SIM.
• Network traffic to Firebase Realtime Database endpoints or Telegram from an unfamiliar app.

Per-build signing certificates change every time, so certificate-hash blocklisting is futile against victim builds. CloudSEK notes the operator’s own console app uses a distinct self-signed certificate (CN=MrRobot, O=MrRobot, C=IN, keystore alias MRROBOT) and a hardcoded affiliate App ID, SKY-APP-2026-X9F3, which give two pivots for hunting the operator’s other builds. That console is not meant for victims.

Not confirmed in the sources: total victim count beyond the two tracked affiliates, financial losses, which specific banks were impersonated or hit, and whether any fix or takedown has happened. CloudSEK noted the Firebase sink for Affiliate A held just one device at analysis, consistent with a freshly rotated or purged backend.

What to do now

1. Do not install bank-branded apps from links sent by text, WhatsApp or Telegram. This is CloudSEK’s direct advice to users Infosecurity Magazine. Use only your bank’s official app from a trusted store.
2. Check call forwarding in your phone’s call settings if you ever sideloaded a bank, biller or government app. Turn off any forwarding you did not set up. The specific carrier disable code is not confirmed in the sources.
3. If you suspect infection, treat banking credentials, card details and UPI PINs as compromised. Contact your bank, and remove the app. Because it may have no launcher icon, look for it in the system app list.
4. Banks should move customers from SMS OTP toward app-based or FIDO authentication where feasible Infosecurity Magazine.
5. Do not trust phone callbacks alone as a fraud check. Call forwarding can reroute them to the attackers.
6. Hunt on the operator-side pivots: the CN=MrRobot certificate, the MRROBOT keystore alias, the App ID SKY-APP-2026-X9F3, and the com.apkshield.installer.* package prefix. Do not rely on victim-build certificate hashes.
7. Report and take down the Firebase projects and Telegram channels that receive stolen data. CloudSEK calls Firebase takedown a high-leverage disruption point because each affiliate’s whole catalog drains into a single project CloudSEK.
8. Adjust malware analysis for the evasion: emulator checks, a 48-hour or 3-launch dormancy gate and a local-VPN black-hole can make quick sandbox runs look clean.

Sources

• CloudSEK: Inside “MR ROBOT”, Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers
• Infosecurity Magazine: MR ROBOT Malware-as-a-Service Targets Indian Bank Customers